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Abstract 



Preference aggregation in a multiagent setting is a central issue in both human and computer con- 
texts. In this paper, wc study in terms of complexity the vulnerability of preference aggregation to 
destructive control. That is, we study the ability of an election's chair to, through such mechanisms 
as voter /candidate addition/suppression/partition, ensure that a particular candidate (equivalently, 
alternative) docs not win. And we study the extent to which election systems can make it impos- 
sible, or computationally costly (NP-complete), for the chair to execute such control. Among the 
systems we study — plurality, Condorcet, and approval voting — we find cases where systems immune 
or computationally resistant to a chair choosing the winner nonetheless arc vulnerable to the chair 
blocking a victory. Beyond that, we see that among our studied systems no one system offers the 
best protection against destructive control. Rather, the choice of a preference aggregation system 
will depend closely on which types of control one wishes to be protected against. We also find 
concrete cases where the complexity of or susceptibility to control varies dramatically based on the 
choice among natural tie-handling rules. 

Key words: approval voting, computational complexity, computational resistance, computational 

vulnerability, Condorcet voting, destructive control, distributed artificial intelligence, election sys- 
tems, immunity, plurality voting, preference aggregation, multiagent systems, tie-breaking rules, 
vote suppression, voting systems. 



1 Introduction 



Voting systems provide a broad model for aggregating preferences in a multiagent setting. The 
literature on voting is vast and active, and spans such areas as AI, complexity, economics, operations 
research, and political science. As noted by Conitzer, Lang, and Sandholm |CLS03j . voting has been 
proposed as a mechanism for use in decision-making in various computational settings, including 
planning "EROl ER93| and collaborative filtering PHGOO . Voting also may be useful in many large- 
scale computer settings. Examples of much recent interest include the (web-page) rank aggregation 
problem, and related issues of reducing "spam" results in web search and improving similarity search, 
for which the use of voting systems has been proposed T5KNS01 FKS03|. In such an automated 
setting, it is natural to imagine decisions with thousands or millions of "voters" and "candidates." 

In Bartholdi, Tovey, and Trick's seminal paper "How hard is it to control an election?" |BTT92j . 
the issue of constructive control of election systems is studied: How hard is it for a chair (who 
knows all voters' preferences) to — through control of the voter or candidate set or of the partition 
structure of an election — cause a given candidate (equivalently, alternative) to be the (unique) win- 
ner?^ Bartholdi, Tovey, and Trick studied plurality and Condorcet voting, and seven natural types 
of control: adding candidates, suppressing candidates, partition of candidates, run-off partition of 
candidates, adding voters, suppressing voters, and partition of voters. They found that in some 
cases there is immunity to constructive control (if his/her candidate was not already the^ unique 
winner, no action of the specified type by the chair can make the candidate the unique winner), in 
some cases there is (computational) resistance to constructive control (it is NP-complete to decide 
whether the chair can achieve his/her desired outcome), and in some cases the system is (computa- 
tionally) vulnerable to constructive control (there is a polynomial-time algorithm that will tell the 
chair how to achieve the desired outcome whenever possible"^). 

In this paper, we obtain results for each of their 14 cases (two preference aggregation systems, 
each under seven control schemes) in the setting of destructive control. In contrast with constructive 
control, in which a chair tries to ensure that a specified desirable candidate is the (unique) winner, 
in destructive control the chair tries to ensure that a specified detested candidate is not the (unique) 
winner. Regarding the naturalness of destructivity, the light-hearted title of this paper tries to 
reflect the fact that, in human terms, one often hears feelings expressed that focus strategically on 
precluding one candidate, and of course in other settings this also may be a goal. Regarding the 
reality of electoral control, from targeted "get-out-the-vote" advertisements of parties and candidates 
to (alleged) voter suppression efforts by independent groups, from the way a committee chair groups 
alternatives to any case where a faculty member hands out student course evaluations on a day some 
malcontent students are not in class, it is hard to doubt that the desire for electoral control — both 
destructive and constructive — is a real one. 

Destruction has been previously studied by Conitzer, Lang, and Sandholm |US02IULS03j . but in 
the setting of election manipulation — in which some (coalition of) voters knowing all other voters' 
preferences are free to shift their own preferences to affect the outcome. In contrast, in this paper we 

^In their model, which is also adopted here, the chair has complete information on the voters' preferences. This is 
a natural assumption in many situations. For example, in a computer science department, after endless discussions, 
most people know what each person's position is on key issues. Also, since the case where complete information is 
available to the chair is a special subcase of the more general setting that allows information to be specified with 
any level of completeness, lower bounds obtained in the complete information setting are inherited by any natural 
incomplete information model. 

^Really "a unique winner," since there may be no winner at all, but we'll usually write "t/ie unique winner" when 
this is clear from context. 

^This is more like "computationally certifiably-vulncrable," see Definition l3.ll Vulnerability as defined in |BTT92| 
means one can quickly decide if there exists a way for the chair to achieve the desired outcome. 
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Table 1: Summary of results. Results new to this paper are in boldface. Nonboldface results are 
due to Bartholdi, Tovey, and Trick jBTT92| . Key: I = immune, R = resistant, V = vulnerable, TE 
= Ties-Eliminate, TP = Ties-Promote. 

study destruction in the very different setting of electoral control |BTT92j — where a chair, given fixed 
and unchangeable voter preferences, tries to influence the outcome via procedural/access means. 

One might ask, "Why bother studying destructive control, since any rational chair would prefer 
to assert constructive control?" The answer is that it is plausible — and our results show it is indeed 
the case — that destructive control may be possible in settings in which constructive control is not. 
Informally put, destructive control may be easier for the chair to assert. For example, we prove for- 
mally that of the seven types of constructive control of Condorcet elections that Bartholdi, Tovey, 
and Trick )BTT92| study, the four they showed not vulnerable to constructive control are all vulner- 
able to destructive control. The remaining three cases regarding Condorcet voting are vulnerable to 
constructive control BTT92 , but we show that they are immune to destructive control.'* 

Table n summarizes our results on the complexity of destructively controlling Condorcet, plu- 
rality, and approval elections. We also when needed obtain, for comparative purposes, new results 
on the complexity of constructive control, and Table ^ displays those and also constructive control 
results of Bartholdi, Tovey, and Trick |BTT92| . All entries in boldface in Tableware new results 
obtained in this paper; the other results are due to Bartholdi, Tovey, and Trick |BTT92) . For each 
boldface "V" in the table, "certifiably-vulnerable" is in fact also achieved by our theorems. We men- 

^ Savvy readers may wonder whether there is something very troubling in having a system be vulnerable to con- 
structive control but immune to destructive control. After all, to ensure that the despised candidate c is not the unique 
winner we simply have to ask whether either at least one of the other candidates can be ensured to unique-win-or-tie- 
for-winner or it can be ensured that there are no winners. Put somewhat formally, this implies that for strongly voiced 
(i.e., systems for which whenever there is at least one candidate there will be at least one winner) election systems — 
though of course Condorcet voting is not strongly voiced and so this is not an issue for the three cases mentioned in 
the main text — destructive control polynomial-time disjunctively truth-table reduces ILLtj75l to constructive control 
(redefined to speak not of "unique winner" but to speak of "winner (possibly with others also winning)"), and so 
the destructive control problem can (within a polynomial factor) be no harder computationally than the (redefined) 
constructive control problem (this reduction is noted in a different setting by Conitzer and Sandholm CS02'). Our 
brief explanation of why cases of such a form would not cause a paradox lies in the word "computational" : Although 
immunity is the most desirable case in terms of security from control, the complexity of recognizing whether a given 
candidate can be precluded from winning in immune cases will most typically be in P — after all, we can never, when 
immunity holds, change a given candidate from unique winner to not the unique winner, so the related decision 
problem is typically easy. (Technical side remark: We say "will most typically be in P/is typically" rather than "will 
be in P/is" because for impractical systems that — unlike those here — have winner-testing problems that are not in P, 
it is in concept possible that one can have immunity and yet also have the related language problem not belong to P.) 

The disjunctive-truth-table connection mentioned above explains why, if P 7^ NP, it is impossible for any strongly 
voiced election system to have computational resistance to destructive control hold for any problem that, when 
redefined to embrace ties, is vulnerable to constructive control. 
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tion in passing that for nonboldface "V"s in the table, "certifiably- vulnerable" can be seen directly 
from or by modifying the algorithms of Bartholdi, Tovey, and Trick |BTT92| . 

For control-by-partition problems — which will involve subelection(s) — we distinguish between 
the models Ties-Eliminate (TE, for short) and Ties-Promote (TP, for short), which define what 
happens when there are ties among winners in a subelection (before the final election), namely, all 
participating candidates are eliminated (TE), or all who tie for winner move forward (TP). Note 
that these models do not apply to Condorcet voting, under which when a winner exists s/he is 
inherently unique; so the TE/TP distinction is made only for plurality and approval voting. 

The natural conclusion to draw from our results is that when selecting an election/preference 
aggregation system, one should at least be aware of the issue of the system's vulnerability to control — 
and, beyond that, one's choice of system will depend closely on which types of immunity or com- 
putational resistance one most values. Our results also show that constructive and destructive 
control often differ greatly: A system immune to constructive control may be vulnerable to destruc- 
tive control, and vice versa. Finally, our results show — in contrast with some comments in earlier 
papers — that breaking ties is far from a minor issue: For both voting types where tie-handling rules 
are meaningful, we find cases where the complexity of or susceptibility to control varies dramatically 
based on the choice among natural tie-handling rules. 

2 Preliminaries 

We first define the three voting systems considered. In approval voting, each voter votes "Yes" or 
"No" for each candidate. (So, for approval voting, a voter's preferences are reflected by a 0-1 vector.) 
All candidates with the maximum number of "Yes" votes are winners. Approval voting has been 
proposed as a variant of plurality voting, see Brams and Fishburn |BF83| . 

Plurality and Condorcet voting are defined in terms of strict preferences. For them, an election 
is given by a preference profile, a pair (C, V) such that C is a set of candidates and V is the multiset 
(henceforth, we'll just say set, as a shorthand) of the voters' preference orders on C.^ We assume 
that the preference orders are irreflexive and antisymmetric (i.e., every voter has strict preferences 
over the candidates), complete (i.e., every voter ranks each candidate), and transitive. 

A voting system is a rule for how to determine the winner(s) of an election. Formally, any voting 
system is defined to he a ( social choice ) function mapping any given preference profile (or the analog 
with voters' 0-1 vectors for the approval voting case) to society's aggregate choice set, the set of 
candidates who have won the election. 

In plurality voting, each candidate with a maximum number of "first preference among the 
candidates in the election" voters for him/her wins. In Condorcet voting, for each c S C, c is a 
winner if and only if for each d G C with d ^ c, c defeats d by a strict majority of votes in a pairwise 
election between them based on the voters' preferences. 

The Condorcet Paradox observes that whenever there are at least three candidates, due to cyclic 
aggregate preference rankings Condorcet winners may not exist jCon85j . That is, the set of winners 
may be empty. However, a Condorcet winner is unique whenever one does exist. In the case 
of plurality and approval voting, due to ties, there may exist multiple winners. Regarding ties, 
we — following Bartholdi, Tovey, and Trick |BTT92| to best allow comparison — focus in our control 
problems on creating a unique winner (constructive), and precluding a candidate from being the 

^In various settings involving subelections, adding candidates, and resistance constructions, we will speak of an 
election (C , V) where the preferences of V are over some C 3 C". In such cases, we intend the natural interpretation: 
For the purpose of that election one views the induced preference order (or approval vector) for the restriction to C" . 
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unique winner (destructive). (Ties in subelections, for the partition problems, are handled via the 
TE and TP rules described earlier.) 

3 Results 

The issue of control of an election by the authority conducting it (called the chair) can be studied 
under a variety of models and scenarios. For plurality and Condorcet voting, Bartholdi, Tovey, 
and Trick |BTT92) — and for the rest of this section that paper will be referred to as "BTT92" — 
study constructive control by adding candidates, deleting candidates, partition of candidates, run-off 
partition of candidates, adding voters, deleting voters, and partition of voters. In their setting, the 
chair's goal is to make a given candidate uniquely win the election. Analogously, we consider in turn 
the corresponding seven destructive control problems, where the chair's goal is to preclude a given 
candidate from being the unique winner. For each of these control scenarios, we define the problem 
and present prior results and our results. (Formally, for each type of control one defines a decision 
problem and studies its computational complexity.) To make comparisons as easy as possible, we in 
stating these control problems whenever possible exactly follow BTT92's wording for constructive 
control (except modified to the destructive case for the destructive cases), and when we diverge, we 
explain why and how. 

Control by Adding Candidates 

As is common, we state our decision problems as "Given" instances, and a related Yes/No question. 
The language in each case is the set of all instances for which the answer is Yes. Since in each 
control scenario, the "Given" instance is identical for the constructive and the destructive case, we 
state it just once and then state the corresponding two questions, one for constructive and one for 
destructive control. 

Given: A set C of qualified candidates and a distinguished candidate c G C, a set D of possible 
spoiler candidates, and a set V of voters with preferences (in the approval case, the "prefer- 
ences" will, as always for that case, actually be 0-1 vectors) over C L) D. 

Question (constructive): Is there a choice of candidates from D whose entry into the election 
would assure that c is the unique winner? 

Question (destructive): Is there a choice of candidates from D whose entry into the election 
would assure that c is not the unique winner? 

The above type of control captures the idea that the chair tries to enthrone the desired candidate 
c (in the constructive case) or to dethrone the despised candidate c (in the destructive case) by 
introducing new "spoiler" candidates. 

V is formally a multiset. However, throughout this paper we assume — as is the standard approach 
in papers on the computational complexity of elections — that in the input the preferences are coded 
as a list (the ballots), one voter at a time, and in particular are not encoded as a multiset that uses 
binary numbers to code cardinalities. 

With this first problem — Control by Adding Candidates — stated, now is a good time to define our 
notions of control. Our terminology will closely follow the notions in BTT92, to allow comparison. 

Definition 3.1 We say that a voting system is immune to control in a given model of control (e.g., 
"destructive control via adding candidates ") if the model regards constructive control and it is never 
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possible for the chair to by using his/her allowed model of control change a given candidate from 
being not a unique winner to being the unique winner, or the model regards destructive control and it 
is never possible for the chair to by using his/her allowed model of control change a given candidate 
from being the unique winner to not being a unique winner. If a system is not immune to a type of 
control, it is said to be susceptible to that type of control. 

A voting system is said to be (computationally) vulnerable to control if it is susceptible to control 
and the corresponding language problem is computationally easy (i.e., solvable in polynomial time). If 
a system is not just vulnerable regarding some particular model of control but one can even produce in 
polynomial time the actual action of the chair to execute control the "best" way (namely, by adding or 
deleting the smallest number of candidates or voters for add/delete problems; for partition problems, 
any legal partition that works is acceptable), we say the system is (computationally) certifiably- 
vulnerable to (that model of) control.® 

A voting .system is said to be resistant to control if it is susceptible to control but the corresponding 
language problem is computationally hard (i.e., NP- complete)."^ 

For general background on the theory of NP-completeness, see, e.g., |CT7 9"HU79'. 
As to what is known about Constructive Control by Adding Candidates, BTT92 shows that 
plurality is resistant and Condorcet is immune. Our results are: 

Theorem 3.2 Approval (voting) is immune to constructive control by adding candidates, and plu- 
rality, Condorcet, and approval (voting) are respectively resistant, vulnerable/ certifiably-vulnerable, 
and vulnerable/ certifiably-vulnerable to destructive control by adding candidates. 

So, though Condorcet and approval are immune to constructive control of this sort, they both 
are vulnerable to destructive control. This reverses itself for: 

Control by Deleting Candidates 

Given: A set C of candidates, a distinguished candidate c G C, a set V of voters, and a positive 
integer A: < ||C||. 

Question (constructive): Is there a set of k or fewer candidates in C whose disqualification would 
assure that c is the unique winner? 

Question (destructive): Is there a set of k or fewer candidates in C — {c} whose disqualification 
would assure that c is not the unique winner? 

In this type of control, the chair seeks to influence the outcome of the election by suppressing 
certain candidates (other than c), in hopes that their voters now support c to ensure c's victory 

®For the problems studied here, certifiably-vulnerable implies vulnerable (but we list both, since if one studied 
add/delete problems stated not in terms of "is there some subset" or "by adding/deleting at most fc" but rather in 
terms of "by adding/deleting exactly fc," then for certain systems the implication need not hold). 

^It would be more natural to define resistance as meaning the corresponding language is (many-one) NP-hard. 
However, in this paper, we define resistance in terms of NP-completeness. One reason is that this matches the way the 
term is used by BTT92. More importantly, all the problems discussed in this paper have obvious NP upper bounds 
since testing whether a given candidate has won a given election for the systems considered here is obviously in P. 
So for the problems in this paper, NP-completeness and NP-hardness stand or fall together. We mention in passing 
that there are natural election systems whose complexity seems beyond NP. The first such case established was for 
the election system defined by Lewis Carroll in 1876 IDod76l . where even the complexity of determining whether a 
given candidate has won is now known to be hard for parallel access to NP PTHR97 . Other election systems whose 
winner complexity is hard for parallel access to NP include Kemeny and Young elections, see IHHOOIij VOOItj VOll 
IRSV03.HSV05I . 
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(in the constructive case) or that they now support another candidate to ensure stopping c (in the 
destructive case). Note that this formahzation of the destructive case is not a perfect analog of 
the constructive case of BTT92 in that we exphcitly prevent deleting c, since otherwise any voting 
system in which the winners can efficiently be determined would be trivially vulnerable to this type 
of control. 

Here, BTT92 establishes for constructive control resistance for plurality and vulnerability for 
Condorcet. Our results are: 

Theorem 3.3 Approval is vulnerable/ certifiahly-vulnerable to constructive control by deleting can- 
didates. Plurality, Condorcet, and approval are respectively resistant, immune, and immune to 
destructive control by deleting candidates.^ 

We now handle jointly the two types of partition of candidates, since they yield identical results. 
Control by Partition of Candidates 

Given: A set C of candidates, a distinguished candidate c G C, and a set V of voters. 

Question (constructive): Is there a partition of C into Ci and C2 such that c is the unique winner 
in the sequential two-stage election in which the winners in the subelection (Ci , V) who survive 
the tie-handling rule move forward to face the candidates in C2 (with voter set V)7 

Question (destructive): Is there a partition of C into Ci and C2 such that c is not the unique 
winner in the sequential two-stage election in which the winners in the subelection (Ci , V) 
who survive the tie-handling rule move forward to face the candidates in C2 (with voter set 
V)? 

Control by Run-Off Partition of Candidates 

Given: A set C of candidates, a distinguished candidate cG C, and a set V of voters. 

Question (constructive): Is there a partition of C into Ci and C2 such that c is the unique 
winner of the election in which those candidates surviving (with respect to the tie-handling 
rule) subelections {Ci,V) and (C2, V) have a run-off with voter set V. 

Question (destructive): Is there a partition of C into Ci and C2 such that c is not the unique 
winner of the election in which those candidates surviving (with respect to the tie-handUng 
rule) subelections (Ci, V) and (C2, V) have a run-off with voter set V. 

These two types of control express settings — one via a cascading setup, and one via a run-off 
setup — in which the chair tries to, ovc^rall, partition the candidates in such a clover way that the 
favored candidate c is made the unique winner (in the constructive case) or that the hated candidate 
c fails to be the unique winner (in the destructive case). Here, BTT92 shows that for constructive 
control plurality is resistant (and their result on that holds in both our TE and TP models) and 
Condorcet is vulnerable. Our results are: 

**For this and all other problems whose statements invoke a "fc" bound, by immune wc mean that for no election 
(and thus no k) can the chair's action ever cause change of the sort required to break immunity (i.e., taking someone 
who is not a unique winner and making him/her be a unique winner in the constructive cases, or taking someone who 
is a unique winner and making him/her no longer be a unique winner in the destructive cases), and by susceptible we 
mean "not immune" (under the definition just given). 
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Theorem 3.4 Approval is vulnemhle/ceriJfiably-vulnerable to constructive control by partition of 
candidates and run-off partition of candidates in model TE and immune to constructive control by 
partition of candidates and run- off partition of candidates in model TP. Plurality, Condorcet, and 
approval are, in models TE and TP, respectively resistant, immune, and immune to destructive 
control by partition of candidates and by run- off partition of candidates. 

So Condorcet, though vulnerable to constructive control, is immune to destructive control here. 
And, perhaps more interesting, for constructive control, approval changes from vulnerable to immune 
depending on the tie-handling rule. 

We now turn to control of the voter set. The intuition behind seeking destructive control by 
adding or deleting voters is clear, e.g., getting out the vote and vote suppression. We handle these 
two cases together as their results are identical. 

Control by Adding Voters 

Given: A set of candidates C and a distinguished candidate c € C, a set y of registered voters, an 
additional set W of yet unregistered voters (both V and W have preferences over C), and a 
positive integer k < \\W\\. 

Question (constructive): Is there a set of k or fewer voters from W whose registration would 
assure that c is the unique winner? 

Question (destructive): Is there a set of k or fewer voters from W whose registration would 
assure that c is not the unique winner? 

Control by Deleting Voters 

Given: A set of candidates C, a distinguished candidate c e C, a set F of voters, and a positive 

integer k < \ \V\\. 

Question (constructive): Is there a set of k or fewer voters in V whose disenfranchisement would 

assure that c is the unique winner? 

Question (destructive): Is there a set of k or fewer voters in V whose disenfranchisement would 
assure that c is not the unique winner? 

Here, BTT92 shows that for constructive control plurality is vulnerable and Condorcet is resis- 
tant. Our results are: 

Theorem 3.5 Approval is resistant to constructive control by adding voters and by deleting voters. 
Plurality, Condorcet, and approval are all vulnerable/ certifiably-vulnerable to destructive control by 
adding voters and by deleting voters. 

So Condorcet and approval, though resistant to constructive control, are vulnerable to destructive 
control here. 

The final problem here results in a surprise. 
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Control by Partition of Voters 

Given: A set of candidates C, a distinguished candidate c G C, and a set V of voters. 

Question (constructive): Is there a partition of V into Vi and V2 such that c is the unique winner 
in the hierarchical two-stage election in which the survivors of (C, Vi) and (C, V2) run against 
each other with voter set V? 

Question (destructive): Is there a partition of V into Vi and V2 such that c is not the unique 
winner in the hierarchical two-stage election in which the survivors of (C, Vi) and (C, V2) run 
against each other with voter set V? 

In this last type of control, the voter set is partitioned into two "subcommittees" that both sepa- 
rately select their "nominees," who run against each other in the final decision stage. Unlike BTT92, 
we again distinguish between the two models Ties-Eliminate and Ties-Promote defined above. That 
is, in the Ties-Eliminate model, if two or more candidates tie for winning in a subcommittee's elec- 
tion, no candidate is nominated by that subcommittee. In contrast, in the Ties-Promote model, all 
the candidates who tie for winning in a subcommittee's election are nominated to run in the final 
decision stage. 

We mention that both of our two tie-handling models, TE and TP, differ from the model adopted 
in BTT92, where they for vulnerability results about this problem adopt a third model in which 
ties are handled not by a tie-handling rule but rather by changing the decision problem itself to 
require the chair to find a partition that completely avoids ties in any subcommittee. We find our 
model the more natural, but for completeness we mention that they obtained for this case, in their 
tie model, a constructive-control vulnerability result for plurality. For Condorcet and constructive 
control, BTT92 proves that resistance holds. Our results are: 

Theorem 3.6 Approval is resistant to constructive control by partition of voters in models TE and 
TP, and vulnerable/ certifiahly-vulnerable to destructive control by partition of voters in models TE 
and TP. Plurality is vulnerable/ certifiably-vulnerable to both constructive and destructive control 
by partition of voters in model TE, and is resistant to both constructive and destructive control by 
partition of voters in model TP. Condorcet is vulnerable/ certifiably-vulnerable to destructive control 
by partition of voters. 

The most striking behavior here is that plurality voting varies between being vulnerable and 
being resistant, depending on the tie-handling rule. The loose intuition for this is that in TE, at 
most one candidate wins each subcommittee and in polynomial time we can explore every way this 
can happen. In contrast, under TP potentially any subset of candidates may move forward, and in 
this particular setting, that flexibility is enough to support NP-completeness. Also interesting is that 
both Condorcet and approval, while resistant to constructive control, are vulnerable to destructive 
control. 

4 Proofs 

In this section, we provide the proofs of the results stated in Section |3| Table [3 presents, for each 
of the seven control types considered, the corresponding main result from Section O as well as the 
specific theorems, corollaries, and examples from which this main result follows. 

We first present the immunity and susceptibility results. Then we present the vulnerability 
results, and finally we present the resistance results. The proof techniques employed range from 
political-science-axiom- fueled arguments (for proving immunity), to designing efficient algorithms 
(for proving vulnerability), to the construction of NP-hardness reductions (for proving resistance). 
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Table 2: Overview of results yielding the main results. (For completeness, examples/theorems 
needed to establish susceptibility are listed even when they are invoked within a listed vulnerability 
or resistance theorem/corollary.) 



4.1 Proving Immunity and Susceptibility 

For each of the 39 boldfaced entries in Table ^ this section must establish immunity if the entry 
is a boldface "I" and must establish susceptibility if the entry is a boldface "R" or a boldface "V." 
(Recall that the definitions of resistance and vulnerability require susceptibility, and so proving 
susceptibility is a first step toward proving resistance or vulnerability.) 



4.1.1 Links Between Susceptibility Cases 

Rather than hand-proving each of the 39 cases just mentioned, it makes sense to extract connections 
between the cases. We start by stating four easy but useful dualities. 

Theorem 4.1 1. A voting system is susceptible to constructive control by adding candidates if 
and only if it is susceptible to destructive control by deleting candidates. 

2. A voting system is susceptible to constructive control by deleting candidates if and only if it is 
susceptible to destructive control by adding candidates. 

3. A voting system is susceptible to constructive control by adding voters if and only if it is 
susceptible to destructive control by deleting voters. 

4. A voting system is susceptible to constructive control by deleting voters if and only if it is 
susceptible to destructive control by adding voters. 

This theorem is easy to see, and so its proof is omitted. 
We also have the following four implication results. 

Theorem 4.2 1. If a voting system is susceptible to constructive control by partition of voters 
(in model TE or TP), then it is susceptible to constructive control by deleting candidates. 

2. If a voting system is susceptible to constructive control by partition or run-off partition of 
candidates (in model TE or TP), then it is susceptible to constructive control by deleting 
candidates. 
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3. If a voting system is susceptible to constructive control by partition of voters in model TE, then 
it is susceptible to constructive control by deleting voters. 

4-. If a voting system is susceptible to destructive control by partition or run- off partition of candi- 
dates (in model TE or TP), then it is susceptible to destructive control by deleting candidates. 

Proof. We first prove parts and |21 Let (C, V) be an election and c G C a candidate such that 
c is not the unique winner of (C, V) and such that c can be made the unique winner by partition 
of candidates, run-off partition of candidates, or partition of voters. Fix a partitioned election such 
that c is the unique winner of this election and let D C C be the set of candidates that participate 
in the final round of the partitioned election. Then c is the unique winner of {D,V). Thus, the 
voting system is susceptible to constructive control by deleting candidates. 

For partial let (C, V) be an election and c G C a candidate such that c is not the unique winner 
of (C, V) and such that c can be made the unique winner by partition of voters in model TE. Let 
(Vi,V2) be a partition of V such that c is the unique winner of the partitioned election. Since c 
makes it to the final run-off, and since we are in model TE, c is the unique winner of one of (C, Vi ) 
and (C, V2). Without loss of generality, suppose c is the unique winner of (C, Vi). Thus, the voting 
system is susceptible to constructive control by deleting voters. 

For part ^ let (C, V) be an election and c G C a candidate such that c is the unique winner 
of (C, V) and such that c can be made to be not the unique winner by partition of candidates or 
run-off partition of candidates. Fix a partitioned election such that c is not the unique winner of this 
election and let D C C be the set of candidates that participate in the final round of the partitioned 
election. If c £ 13, then c is not the unique winner of (D, V). li c ^ D, then c is not the unique 
winner of the subelection involving c. Thus, the voting system is susceptible to destructive control 
by deleting candidates. □ 

Let us say that a voting system is voiced if in any election that has exactly one candidate, that 
candidate is always a (and thus, the unique) winner. Note that plurality, Condorcet, and approval 
are all voiced systems. For voiced systems, we have the following three additional results. 

Theorem 4.3 1. If a voiced voting system is susceptible to destructive control by partition of 
voters (in model TE or TP), then it is susceptible to destructive control by deleting voters. 

2. Each voiced voting system is susceptible to constructive control by deleting candidates. 

3. Each voiced voting system is susceptible to destructive control by adding candidates. 

Proof. Fix a voiced voting system. 

For part^ suppose that our voting system is immune to destructive control by deleting voters. 
We will show that it is also immune to destructive control by partition of voters. Let (C, V) be an 
election such that c is the unique winner of (C, V)^ and let (Vi, V2) be an arbitrary partition of V . 
Then c is the unique winner of (C, Vl) and of (C, V2), and so c is the only candidate participating 
in the final run-off (both in model TP and in model TE). Since the voting system is voiced, c wins 
the final run-off, and is thus the unique winner of the partitioned election. It follows that the voting 
system is immune to destructive control by partition of voters. 

For part |21 let C = {c, d] and let V be an arbitrary set of voters with preferences over C. At 
least one of the candidates is not a unique winner of (C, V). Without loss of generality, let c not be 
a unique winner of (C, V). Since the voting system is voiced, c is the unique winner of ({c}, V). It 
follows that the voting system is susceptible to constructive control by deleting candidates. 

Part 13 follows immediately from part El of this theorem and part El of Theorem 14. II □ 
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Since plurality, Condorcet, and approval are all voiced systems, we immediately have from 
Theorems 14.31 and 14.11 the following results that yield susceptibility results for four of Table QJs 
boldface "R" and boldface "V" entries. 

Theorem 4.4 Plurality, Condorcet, and approval are each susceptible to destructive control by 
adding candidates. Approval is susceptible to constructive control by deleting candidates. 

4.1.2 Immunity Results 

We start by proving the immunity results of Theorems 13.21 13.31 and 13.41 These results are gen- 
erally clear from the definitions. Bartholdi, Tovey, and Trick BTT92 observed^ that immunity 
to constructive control by adding candidates follows from the "unique" version of the Weak Ax- 
iom of Revealed Preference (denoted by Unique-WARP), which says that a unique winner among 
a collection of candidates always remains a unique winner among every subcoUection of candidates 
that includes him/her. Theorem 14.61 states ways in which Unique- WARP influences a variety of 
destructive control scenarios. 

Theorem 4.5 [BTT92J Any voting system that satisfies Unique-WARP is immune to constructive 
control by adding candidates. 

Theorem 4.6 Any voting system that satisfies Unique-WARP is immune to destructive control by 
deleting candidates and (in both model TE and model TP) to destructive control by partition and 
run- off partition of candidates. 

Theorem 14 . 61 follows from Theorcm l4.5l via Theorems I4.1l and l4.2l fand also is directly clear). 

Bartholdi, Tovey, and Trick [BTT92) note that Theorem 14 . 51 can be applied to show that Con- 
dorcet voting is immune to constructive control by adding candidates. We state further immunity 
results, via Theorems 14.51 and 14.61 as Corollarv l4.7l 

Corollary 4.7 1. Condorcet voting is immune to destructive control by deleting candidates, par- 
tition of candidates, and run- off partition of candidates. 

2. Approval voting is immune to constructive control by adding candidates, and is immune to 
destructive control by deleting candidates and by partition and run- off partition of candidates 
(in both the TE and the TP models). 

Proof. Both Condorcet and approval voting clearly satisfy Unique-WARP. The result now follows 
from Theorems 14.51 and 14. 61 □ 

Note that, unlike Condorcet and approval, plurality voting does not satisfy Unique-WARP, and 
we will see that immunity does not hold for plurality in any control scenario considered here. 
We now state and prove the final two immunity results. 

Theorem 4.8 Approval voting is immune to constructive control by partition and run- ojj partition 
of candidates in model TP. 

Proof. It is easy to see that in approval voting, a candidate c is the unique winner if and only if 
there is a unique candidate with a maximum number of Yes votes and c is that candidate. In the 
TP model, this remains true even under the two partitioning schemes. □ 



^ Their paper is somewhat nonspecific regarding the uniqueness issue and merely says WARP. 
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4.1.3 Susceptibility Results 

We now turn to proving susceptibility results for the 28 boldface "R" and boldface "V" boxes in 
Table n 

Note that in concept each of the "R" and "V" claims made by Bartholdi, Tovey, and 
Trick (ijTT92| is asserting a susceptibility result, and around eight of those — via our Section [4. 1.11 
theorems — imply eight of the 28 susceptibility results that we need. However, Bartholdi, Tovey, and 
Trick BTT92 generally do not prove their susceptibility claims, and so we will prove susceptibility 
here for all our 28 cases. 

Now, how does one prove susceptibility? One need simply give an example in each case. Alterna- 
tively, some cases we get indirectly from an earlier example via our Section f4. 1 . ll theorems. However, 
please note that even in those cases, there is implicitly a concrete example, as the theorems of Sec- 
tion l4.1.'Tl have constructive proofs. Also, we mention again that plurality, Condorcet, and approval 
are all voiced voting systems (in the sense defined in Section Pi. l.l|l . 

We first show that plurality is not immune to constructive or destructive control by partition of 
voters in model TE or to destructive control by deleting voters. 

Example 4.9 Let us consider destructive control by partition of voters in model TE. Let C = 
{a,b,c}, and define V to consist of five voters with the following preferences: 

Vi : a > b > c, V2 '■ a > b > c, 
V3 : b > a > c, V4 : b > a > c, 
: c > a > b. 

Thus, c does not win in (C,V). However, if we partition V into Vi = {v^} and V2 = V — Vi, c 
trivially wins the subelection (C, Vi), but a and b tie for winner in the subelection (C, V2), so none 
of them proceeds to the run-off with c in model TE. It follows that c is the unique run-off winner. 
Thus, plurality voting is susceptible to constructive control by partition of voters in model TE. 

For the destructive case, a is the unique plurality winner in the election {C,V'), where V' — 
{vi,V2,V3,vq}. Now, partitioning V' into V-^ — {vi^v^} and V2 = {v2,V5} implies that none of 
the two subcommittees nominates a candidate in model TE, due to ties. In particular, a is not the 
unique run-off winner, and plurality voting thus is susceptible to destructive control by partition of 
voters in model TE. 

By Theorem \4-.S\ this latter susceptibility claim implies that plurality is susceptible to destructive 
control by deleting voters (which is another of the 28 boldfaced "R"-or- "V" boxes we are handling). 

We now prove that Condorcet voting is susceptible to destructive control by partition of voters 
and to destructive control by deleting voters. 

Example 4.10 Let us consider destructive control by partition of voters. Let C = {a,6, c}, and 
define V to consist of seven voters with the following preferences: 

vi : c > a > b, V2 ■ c > a > b, v^ : c > b > a, 
V4 : b > a > c, : b > c > a, 
vq : a > b > c, Vj : a > c> b. 

Since in pairwise contests four voters prefer c to a and four voters prefer c to b, c is the Condorcet 
winner in the election (C,V). However, partitioning V into Vi = {vi,vy} and V2 = V — Vi implies 
that there is no Condorcet winner in the subelection (C, Vi), and b is the Condorcet winner in the 
subelection (C, V2). Thus, Condorcet voting is susceptible to destructive control by partition of voters. 

By Theorem \4.Sl this susceptibility claim implies that Condorcet is also susceptible to destructive 
control by deleting voters. 
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We now prove that approval voting is susceptible to destructive control by partition of voters in 
models TE and TP, to destructive control by deleting voters, and to constructive control by adding 
voters. 

Example 4.11 Let C = {a,b,c}, and define V to consist of the following ten voters (specified by 
vectors from {0, 1}^, with the first, second, and third bits specifying approval/ disapproval for a, b, 
and c): vi ^ V2 = ^ V4 ~ 001, V5 = = vj = 100, and vs — vg ^ viq = 010. In (C, V), c is the 
unique approval winner. But ifV is partitioned into V\ = {y\.,vi,v^,v^,V'j^ and V2 — V ~V\, then a 
and b are nominated by the subcommittees Vi and V2, respectively, and tie for winner in the run-off. 
Thus, approval voting is susceptible to destructive control by partition of voters, both in model TE 
and in TP. 

By Theorem \4.c\ this susceptibility claim implies that approval voting is also susceptible to de- 
structive control by deleting voters. And that claim itself, by Theorem \41\ implies that approval 
voting is also susceptible to constructive control by adding voters. 

The following example shows that both plurality voting and Condorcet voting are not immune 
to destructive control by adding voters. 

Example 4.12 Let C = {a, 6, c}. Define V to consist of one registered voter v with preference 
c > a > b, and define W to consist of one as yet unregistered voter w with preference a > c > b. Can- 
didate c is the unique winnei — both for plurality and Condorcet voting — in the election {C,V), yet 
registration of w would assure that a and c tie in first-place votes in (C, V U W), so c is not the unique 
plurality winner of this election. Similarly, c is no longer the Condorcet winner in (C, V U W). Thus, 
both plurality and Condorcet voting are susceptible to destructive control by adding voters. 

The following example shows that approval voting is not immune to destructive control by adding 
voters or to constructive control by deleting voters. 

Example 4.13 Let us consider destructive control by adding voters. Let C = {a,b,c}. Define V 
to consist of one registered voter v — 001 (i.e., v approves of c and disapproves of a and b), and 
define W to consist of one unregistered voter w — 100. In {C',V), c is the unique approval winner, 
yet registration of w would assure that a and c tie for winner in (C, V U W), so c is not the unique 
plurality winner of this election. Thus, approval voting is susceptible to destructive control by adding 
voters. 

By Theorem \4-.l\ this susceptibility claim implies that approval voting is also susceptible to con- 
structive control by deleting voters ( and indeed, as implicit in the proof of Theorem this very 
same example works to show that). 

We now show susceptibility for approval voting to constructive control by partition of candidates 
and run-off partition of candidates, both in model TE. 

Example 4.14 Let C ~ {a, b, c} be the candidate set. Let the voter set W consist of the two voters 
with vector representation wi — 111 and W2 — 110, respectively. Then c loses to both a and b, who 
tie for winning in the election (C, W). But if we partition C into Ci = {a, 6} and C2 = {c}, then no 
one moves forward from the subelection {Ci,W) in model TE, so c wins overall. The same example 
works for the run- off partition of candidates case, since no one moves forward from the subelection 
{Ci,W) in model TE and c first wins the subelection {C2,W) and then the run-off. Thus, approval 
voting is susceptible to constructive control by both partition of candidates in model TE and run-off 
partition of candidates in model TE. 
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Example 14.151 shows that plurahty voting is susceptible to destructive control by partition and 
run-off partition of candidates (both in model TE and TP), and to destructive control by deleting 
candidates. 

Example 4.15 Let us consider the partition cases. Let C ~ {a, 6, c, d} be the candidate set, and 
define the voter set V to consist of the following seven voters: 

• 3 voters of the form c > a > b > d, 

• 2 voters of the form a > d > b > c, and 

• 2 voters of the form b > d > a > c. 

Note that c is the unique plurality winner in the election {C,V). 

Now, partition the candidate set C into Ci = {a, c} and C2 ~ {b,d}. Then a is the unique 
plurality winner in the subelection {Ci,V). So c is dethroned in the partition of candidates setting. 
Ci — {a,c} and C2 = {b,d} also dethrones c in the run- off partition of candidates setting. Thus, 
plurality voting is susceptible to destructive control by partition and by run- off partition of candidates. 
Since each subelection has a unique winner (a in (Ci,V) and b in {C2,V)), this is true regardless 
of the tie-handling rule. 

By Theorem \4.°'^ these susceptibility claims imply that plurality voting is also susceptible to de- 
structive control by deleting candidates. 

The next example shows that plurality voting is susceptible to constructive and destructive 
control by partition of voters in model TP. 

Example 4.16 Let C = {a, 6, c} be the candidate set, and define the voter set V to consist of the 
following eight voters: 

• 3 voters (say ui, U2, and u^) of the form a > c> b, 

• 2 voters (say vi and V2) of the form b > a > c, and 

• 3 voters (say wi, W2, and W3) of the form c> a > b. 

For the constructive case, note that c is not the unique plurality winner in the election {C,V), 
since a and c are tied for first place. Now, partition V into Vi = {ui, 1*2, wi, 1^2, W3} and V2 = 
{m3, Vi, V2}. Then c is the unique plurality winner in the subelection (C, Vi), b is the unique plurality 
winner in the subelection (C, V2), and c wins the run-off against b. Thus, plurality voting is not 
immune to constructive control by partition of voters in model TP. 

For the destructive case, consider the election {C,V') with V' = V U {v^^w^}, where v^ votes 
b > a > c and W4 votes c > a > b. In (C,V'), c is the unique plurality winner. Partition V' into 
V{ = {ui,U2,U3,wi,W2} and V2 = {wi, W2, fa, W3, W4}. Then a is the unique plurality winner of the 
subelection {C, V(), b is the unique plurality winner of the subelection (C, V2), and a wins the run-off 
against b. So c is dethroned. Thus, plurality voting is not immune to destructive control by partition 
of voters in model TP. 

Finally, we show that approval voting is susceptible to constructive control by partition of voters 
in models TE and TP. 
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Example 4.17 Let C = {a,b,c\ be the candidate set. Define the voter set V to consist of the 
following eight voters: Wi = f 2 = ^3 = 100, U4 = W5 = DID, and = = = 001. In {C,V), 
a and c are tied. Now, partition V into Vi = {vi,V2,vq,vt,vs} and V2 = {vs^v^^v^}. Candidate 
c is the unique approval winner in the subelection (C, Vi), b is the unique approval winner in the 
subelection (C, V2), and c wins the run- off against b. This works both in model TE and TP, since ties 
do not occur in the subelections in our construction. So approval voting is susceptible to constructive 
control by partition of voters (both in TE and TP). 

4.2 Proving Vulnerability 

The certifiably-vulnerable results (which here imply the vulnerable results) range from clear greedy 
algorithms to trickier algorithms based on characterizing the ways in which a candidate can be made 
to win (in the constructive case) or can be precluded from winning (in the destructive case). The 
more surprising of these have to do with the tie-handling cases of partition problems — where the 
chair can at times do shrewd things (e.g., shift voters counterintuitively to induce ties that kill off 
stronger candidates). 

4.2.1 Partition of Voters 

We start with the "control by partition of voters" problems. For plurality voting, we here obtain the 
same results in the constructive and the destructive stated in Tableland in Theorem 13. 61 

On the other hand, the question of whether resistance or vulnerability holds depends on which 
tie-handling rule is chosen. 

Theorem 4.18 In model TE, plurality voting is vulnerable/ certifiably-vulnerable to constructive 
control by partition of voters. 

Proof. By Example 14.91 susceptibility holds. 

Given a set of candidates C, a distinguished candidate c ^ C, and a voter set V , we describe 
a polynomial-time algorithm for this problem. For any partition (14,^2) of the voter set V, let 
Nominees{C,Vi), i G {1,2}, denote the set of candidates who are nominated by the subcommittee 
Vi (with candidates C) for the run-off in model TE. To ensure that c is the unique winner, under the 
desired partition setup, we may without loss of generality focus on the following five cases (Cases 3 
and 5 are not necessarily disjoint): 

Case 1: Nominees{C, Vi) = {c} and Nominees{C, V2) = due to V2 ~ 0. 
Case 2: Nominees{C,Vi) — {c} and N ominees{C ,¥2) = {c}. 

Case 3: Nominees{C,Vi) = {c} and Nominees{C,V2) — due to c and d (and possibly additional 
other candidates) tying, where c d. 

Case 4: NomineesiC, Vi) = {c} and Nominees{C, V2) ~ {d}, where c/^ d. 

Case 5: N ominees(C ,Y\) = {c} and Nominees{C,V2) — due to d and e (and possibly additional 
other candidates) tying, where c d ^ e ^ c. 

In Case 1, it clearly suffices to check whether c is an overall plurality winner. Note further that 
if Case 2 holds for some partition (Vi, V2), then c must be an overall plurality winner, and thus will 
also win via the partition (V, 0). We now argue that the same is true in Case 3. For any candidate i, 
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let score{i) denote the number of voters who rank i first-place in (C, V). In Case 3, note that for all 
eeC-{c}, 



score{e) < score[c), 

since c has strictly more first-place votes than e in (C, Vi ) and e at best ties c for first-place votes 
in (C, V2). It follows that c must already be an overall plurality winner in Case 3, and thus will also 
win via the partition (V, 0). 

So, our algorithm, after checking whether c is a plurality winner overall (thus catching Cases 1, 
2, and 3), will by brute force check whether Case 4 or Case 5 can be made to hold for some partition 
of the voter set. 

Given C, c, and V as above, our polynomial-time algorithm proceeds as follows. If c is a plurality 
winner of (C, F), output (V, 0) as a successful partition and halt; else if ||C|| = 2, then output 
"control impossible" (which in this context means that making c a unique winner is impossible) and 
halt. Otherwise, we first try to make Case 4 hold and then, if that fails, try to make Case 5 hold. 
These two tests are implemented by the two loops described below, and if they both fail, control is 
not possible. 

Loop trying to make Case 4 hold: For each d E C , d ^ c, such that c beats d in a pairwise 
plurality election by the voters in V, do the following: If it holds that, for each e G C with 

c ^ e ^ d, 

score{e) < score{c) + score{d) — 2, 

then output (Vi, V2) as a successful partition and halt, where Vi consists of all score{c) voters 
whose first choice is c and exactly min(score(e), score{c) — 1) of the voters whose first choice 
is e, and where V2 ~ V — Vi. 

Loop trying to make Case 5 hold: If the loop trying to make Case 4 hold was not successful, 
then for each G C and for each e G C such that ||{c, d, e}|| = 3 and score{d) < score{e), do 
the following: If it holds that, for each f E C — {c}, 

score{f) < score{c) + score{d) — 1, 

then output (Vi, V2) as a successful partition and halt, where Vi consists of all score{c) voters 
whose first choice is c, of exactly score{e) — score{d) of the voters whose first choice is e, and 
for all / G C — {c, d, e}, exactly min(score(/), score{c) — 1) of the voters whose first choice is /, 
and where V2 ^ V — Vi. 

Otherwise (i.e., if the Case 5 loop was not successful either), c cannot win, so we output "control 
impossible" and halt. □ 

We now make a general remark. In various cases, our polynomial-time algorithms have loops. In 
some cases, these loops can be collapsed or removed. Doing so 

• improves the runtime and makes the algorithm look simpler, but 

• makes it a bit harder to see that the algorithm is correct. 

Since correctness is what we most care about, we do not collapse such loops. But let us explicitly 
mention the "look" of such collapses. In the proof of Theorem 14. 181 above, the "For each d G C, 
d ^ c, such that c beats d in a pairwise plurality election by the voters in V, do. . . " loop trying to 
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make Case 4 hold in the algorithm can safely be changed to: "If there exists some d' G C, d' c, 
such that c beats d' in a pairwise plurality election by the voters in V, then let d be some such d' 
for which score{d) is maximized among all such score(d!) and do. . . " This is a legal loop collapse, 
since if some d' works, then it works for all d" that can pairwise beat c in a run-off whose score{d") 
is maximum. Again, this is just an example, and to have our correctness as unobscured as possible 
and as our focus is on the gap between P and NP-hard, we in general forgo such optimizations of 
the precise polynomial of the runtime. 

We now turn to the destructive analog of Theorem l4.18l 

Theorem 4.19 In model TE, plurality voting is vulnerable/ certifiably-vulnerahle to destructive con- 
trol by partition of voters. 

Proof. That susceptibility holds in this case has been shown in Example 14.91 

Given a set of candidates C, a distinguished candidate c G C, and a voter set V , our polynomial- 
time algorithm for this control problem works as follows. If C = {c}, output "control impossible" 
and halt, as c must win; else if c already is not the unique plurality winner, output (V, 0) as a 
successful partition and halt. Now, we check if every voter's first choice is c or if ||C|| = 2, and if 
one of these two conditions is true, we output "control impossible" and halt, since c cannot help but 
win. 

Again, let score{i) denote the number of voters who rank candidate i first-place. Let d be a 
candidate who other than c got the most first-place votes, and let e be a candidate who other than 
c and d got the most first-place votes. We can certainly dethrone c if 

(4.1) score{c) < score{d) + score{e). 

Namely, if Equation 1)4.1(1 holds, we output (Vi,V2) as a successful partition and halt, where Vi 
consists of all score{d) voters whose first choice is d and exactly score{d) voters whose first choice is 
c (recall that in the current case we already know that score{c) > score{d)), and where V2 = V — Vi. 
Then c and d will tie for winner in (C, Vi), so no one will be nominated by the subcommittee Vi in 
model TE, and e will tic or beat c in (C, V2), so c is not nominated by the subcommittee V2 either. 
On the other hand, if Equation (|4.1|l is not satisfied, we have 

score{c) > score{d) + score{e), 

so in any partition (Vi,V2), c clearly will triumph in one of {C,Vi) or {C,V2). Thus, we now 
know it is impossible to make sure that c loses in both subcommittees. If c is nominated by both 
subcommittees (in model TE), c trivially is the unique winner of the final run-off. So, our algorithm 
now checks if it is possible for c to win in exactly one subcommittee, and yet can be made to not be 
the unique winner of the final run-off. For this to happen, it is (given the case we are in) a necessary 
and sufficient condition that there exists some candidate d such that: 

• d c, 

• d ties or beats c in a pairwise plurality election, and 

• for each candidate e, c ^ e ^ d, we have that score(e) < score{c) + score(d) — 2. 

We can in polynomial time brute-force check whether the above three conditions hold for some 
candidate d, and if they do, let d' be some such candidate d and output (Vi,V2) as a successful 
partition and halt, where Vi consists of all score{c) voters whose first choice is c and, for each 
candidate e with c 7^ e ^ d', of exactly min(score(c) — 1, score{e)) voters whose first choice is e. 
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and where V2 — V — Vi. Finally, if the above two conditions cannot be satisfied for any d, output 
"control impossible" and halt. □ 



We now prove that Condorcet voting is vulnerable/certifiably- vulnerable to destructive control 
by partition of voters. 

Theorem 4.20 Condorcet voting is vulnerable/ certifiably-vulnerable to destructive control by parti- 
tion of voters. 

Proof. By Example I4.1UI susceptibility holds. 

Given a set of candidates C, a distinguished candidate c G C, and a voter set V ^ our polynomial- 
time algorithm for this control problem proceeds in three stages: 

1. Checking the trivial cases: If C = {c}, output "control impossible" and halt, as c must 
win. Otherwise, if c already is not the Condorcet winner, output (V, 0) as a successful partition 
and halt. Otherwise, if ||C|| = 2, output "control impossible" and halt, since in this case c is 
the Condorcet winner, so c is preferred by a strict majority of votes to the other candidate 
and thus will win at least one subcommittee and also the run-off. 

2. Loop: Now, if none of the trivial cases applies, for each a, 6 £ C with ||{a, 6, c}|| = 3, we test 
whether we can make a tie or beat c in (C, Vi) and make b tie or beat c in (C, V2). For each 
voter, we will now focus just on the ordering of a, 6, and c. We use the following notation. 
Denote the number of voters with order c>a>bovc>b>ahy Wc, with order a > b > c 
or 6 > a > c by Lc, with order a > c > 6 by Sa, and with order b > c > ahy Sb- 

If Wc — Lc > Sa + Sb, then this a and b are hopeless, so move on to consider the next a and b 
in the loop. Otherwise, we have 

(4.2) Wc-Lc < Sa + Sb. 

Output {Vi,V2) as a successful partition and halt, where Vi contains all the Sa voters with 
order a > c> b, and also min(W^c, Sa) voters contributing to Wc, and where V2 = V — V\. 

In (C, V\), a ties or beats c, since a gets Sa votes and c gets min(Wc, Sa) votes. And in (C, V2), 
b ties or beats c, since there are Sb+Lc voters who prefer b to c, and there are Wc — mm{Wc, Sa) 
voters who prefer c to b. Thus, to prove that the construction works, we need that 

Sb + Lc> Wc-mmiWc,Sa), 

which is equivalent to 

(4.3) Sb + mm{Wc,Sa) > Wc - Lc- 

But if Sa < Wc then Equation H4.3|) is implied by Equation (|4.2|) . and if Sa > Wc then 
Equation 14.3|l follows immediately from the fact that Sb + Lc > 0. Thus, b indeed ties or 
beats c in (C, V2). 

3. Termination: If in no loop iteration did we find an a and b that allowed us to output a 
partition of voters dethroning c, then output "control impossible" and halt. 

This completes the proof of Theorem 14.201 □ 

We now prove that approval voting is vulnerable/certifiably- vulnerable to destructive control by 
partition of voters in models TE and TP. 
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Theorem 4.21 Approval voting is vulnerable/ certifiably-vulnerahle to destructive control by parti- 
tion of voters in models TE and TP. 



Proof. That susceptibility holds in this case is shown by Example 14. Ill 

We describe two polynomial-time algorithms for these two control problems, one for TE and one 
for TP. Given a set of candidates C, a distinguished candidate c £ C, and a voter set V, both 
algorithms again proceed in the following three phases: 

1. Checking the trivial cases: If C = {c}, output "control impossible" and halt, as c must 
win. Otherwise, if c already is not the unique winner, output (V, 0) as a successful partition 
and halt. Otherwise, if ||C|| = 2, output "control impossible" and halt, since in this case c is 
the unique winner, so c will win in at least one subcommittee and will also win the run-off. 

2. Loop: In this phase, if none of the trivial cases applies, we try to find a pair of candidates, 
a and b, that allows us to determine a successful partition of voters. This phase is described 
below, separately for TE and TP. 

3. Termination: If in no loop iteration did we find an a and b that allowed us to output a 
partition of voters dethroning c, then output "control impossible" and halt. 

The two algorithms differ only in the second phase. To describe one loop iteration for some pair 
of candidates, a and 6, we use the following notation: For each voter in V, we focus just on his/her 
approval of a, b, and c, represented (in that order) as a vector from {0, 1}'^. Denote the number of 
voters with preference 001 by Wc, with 110 by L^, with 100 by Sa, with 010 by Si,, with 101 by Sac, 
and with Oil by Stc- (Voters with preference 000 or 111 need not be considered, since they do not 
affect the difference of Yes votes among a, b, and c.) 

Loop in model TE: For each a,b ^ C with l|{a,6, c}|| = 3, we test whether we can make a tie or 
beat c in (C, Vi ) and make b tie or beat c in (C, V2 ) . 

If Wc ^ Lc > Sa + Sb, then this a and b are hopeless, so move on to consider the next a and b in 
the loop. Otherwise, we have 



Output (^1,^2) as a successful partition and halt, where Vi contains all voters contributing to 
Sac and ^o, and also min(T/Fc, Sa) voters contributing to Wc, and where V2 — V — V\. 
In (C, Vi), a ties or beats c, since a gets 



(4.4) 



Wc-Lc < Sa+Sb. 



Sa-mm{Wc,Sa) >0 



more Yes votes than c. And in (C, V2), b ties or beats c, since b receives 



Sb + Lc- {Wc 



mm{Wc,Sa)) 



more Yes votes than c. So, for the construction to work, we must argue that 



Sb + Lc + mm{Wc,Sa)-Wc>0. 



That is, we need 



(4.5) 



Wc-Lc < mm{Wc, Sa) + Sb. 
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If Wc < Sa, Equation (|4.5|l follows trivially from the fact that < Lc + St- And if Wc > Sa, 
Equation H4.5|l follows immediately from Equation H4.4|) . 

Loop in model TP: For each a,b ^ C with \\{a, 6, c}|| = 3, we test whether we can make a strictly 
beat c in (C, Vi) and make b strictly beat c in (C, ¥2). 

If Wc — Lc > Sa + Sb — 2 01 Sa = or Si, = 0, then this a and b are hopeless, so move on to 
consider the next a and b in the loop. Otherwise, we have 

(4.6) Wc-Lc < Sa + St.-2 

and Sa > and Sb > 0, and output {Vi, V2) as a successful partition and halt, where Vi contains all 
voters contributing to Sac and Sa, and also mm(Wc, Sa ~ I) voters contributing to Wc, and where 
V2 = V-Vi. 

In (C, Vi), a (strictly) beats c, since a gets 

Sa - miniWc, Sa - 1) > 

more Yes votes than c. And in (C, V2), b (strictly) beats c, since b has 

Sb + Lc- [Wc - min{Wc, Sa - 1)) 

more Yes votes than c. So, for the construction to work, we must argue that 

Sb + Lc + mm{Wc, Sa-l)-Wc> 0. 

That is, we need 

(4.7) Wc~Lc < mm{Wc,Sa-l) + Sb. 

If Wc < Sa~l, Equation (|4.7|) reduces to < Lc + Sb, which follows from the fact that in the current 
case Sb > 0. And if Wc > Sa — I, Equation H4.7|l follows immediately from Equation H4.6() . □ 

4.2.2 Adding and Deleting Voters, Destructive Case 

We now turn to proving the vulnerability results for destructive control by adding and by deleting 
voters for each of plurality, Condorcet, and approval voting. We start with plurality voting. 

Theorem 4.22 Plurality voting is vulnerable/ certifiably-vulnerable to destructive control both by 
adding voters and by deleting voters. 

Proof. By Examples 14.91 and 14 . 1 21 susceptibility holds. 

In a nutshell, for the adding voters case, we give a "smart greedy" algorithm, and for the deleting 
voters case, we give a "dumb greedy" algorithm. In both cases, we prove only that plurality voting 
is certifiably-vulnerable to destructive control, since this implies vulnerability. Recall that no "fc" 
is specified in the corresponding control problems, as in this setting the chair seeks to determine in 
polynomial time the smallest number of voters needed to be added or deleted to execute control. 

In the adding voters case, we are given a set C of candidates, a distinguished candidate c, a set 
V of registered voters, and an additional set W of as yet unregistered voters (both V and W have 
preferences over C). If c already is not a unique plurality winner in the election (C, V), adding no 
voters accomplishes our goal, and we are done. Otherwise, sort all candidates in C distinct from 
c by how many votes each needs to tie c. Let di denote the ith candidate in the ordering thus 
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obtained, and let diff(di) denote d^'s deficit of first-place votes needed to tie c. Thus, the order 
is such that diff{di) < diff{d2) < ■ • ■ < '^*if(c'||c||-i)- For i = 1,2, ... , ||C|| — 1, if the number of 
unregistered voters whose first choice is di is greater than or equal to dijj{di), then add dijf{di) of 
these unregistered voters to ensure that di ties c (and c thus is not the unique winner) and halt. If 
in no iteration of this for-loop was some candidate able to dethrone c, output "control impossible" 
and halt. 

In the deleting voters case, we are given a set C of candidates, a distinguished candidate c, and a 
set V of voters with preferences over C. If C = {c}, then output "control impossible" and halt; else 
if c already is not the unique plurality winner in the election (C, V), deleting no voters accomplishes 
our goal, and we are done. Now, if every candidate other than c gets zero first-place votes, then 
output "control impossible" and halt. Otherwise, let d be the candidate closest to c in first-place 
votes, and let diff{d) denote d's deficit of first-place votes needed to tie c. Then deleting diff{d) 
voters whose first choice is c assures that c is not the unique winner, and this is the fewest deletions 
that can achieve that. □ 



Theorem 4.23 Condorcet voting is vulnerable/ certifiahly-vulnerable to destructive control both by 
adding voters and by deleting voters. 

Proof. By Examples 14.101 and 14 . 1 21 susceptibility holds. 

We again prove only certifiable vulnerability, since this here implies vulnerability. 

In the adding voters case, we are given a set C of candidates, a distinguished candidate c, a set 
V of registered voters, and an additional set W of as yet unregistered voters (both V and W have 
preferences over C). If C {c}, then output "control impossible" and halt; else if c already is not 
a Condorcet winner in the election (C, V), adding no candidates accomplishes our goal, and we are 
done. Otherwise, for each candidate i c, call i lucky if and only if the surplus of c relative to i 
(denoted by surplus{c, i), which is defined as the number of registered voters who prefer c to i minus 
the number of registered voters who prefer i to c) is less than or equal to the number of unregistered 
voters who prefer i to c. If there is at least one lucky candidate, then let d be a lucky candidate 
such that the surplus of c relative to d is minimum, and add surplus{c, d) unregistered voters who 
prefer d to c. If there exists no lucky candidate, output "control impossible" and halt. 

In the deleting voters case, we are given a set C of candidates, a distinguished candidate c, and a 
set V of voters with preferences over C. If C = {c}, then output "control impossible" and halt; else 
if c already is not a Condorcet winner in the election (C,V), deleting no candidates accomplishes 
our goal, and we are done. Otherwise, find a candidate d who comes closest to c (i.e., relative to 
whom the surplus of c is minimum), and delete surplus(c, d) voters from V who prefer c to d. Now 
c and d tie, so c is dethroned. □ 



Theorem 4.24 Approval voting is vulnerable/ certifiahly-vulnerable to destructive control both by 
adding voters and by deleting voters. 

Proof. That susceptibility holds in this case is shown by Examples 14. 1 II and 14. 131 
As before, we prove only certifiable vulnerability, since this here implies vulnerability. 
In the adding voters case, we are given a set C of candidates, a distinguished candidate c, a 
set V of registered voters, and an additional set W of as yet unregistered voters (both V and W 
have preferences over C). If C = {c}, then output "control impossible" and halt. Otherwise, if c 
already is not the unique approval winner in the election (C, V) , adding no candidates accomplishes 
our goal, and we are done. Otherwise, for each candidate i /^ again define surplus{c, i) to be the 
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number of Yes votes for c in V minus the number of Yes votes for i m V . Among all candidates j 
other than c (if any) such that there exist at least surplus{c, j) voters in W who vote Yes for j and 
No for c, let d be any such j for which surplus{c, j) is minimum, and add surplus{c, d) unregistered 
voters who vote Yes for d and No for c. If no j satisfying the above conditions exists, then output 
"control impossible" and halt. 

In the deleting voters case, we are given a set C of candidates, a distinguished candidate c, 
and a set V of voters with preferences over C. If C = {c}, then output "control impossible" and 
halt. Otherwise, if c already is not the unique approval winner in the election (C, V), deleting no 
candidates accomplishes our goal, and we are done. Otherwise, let d be a candidate among C — {c} 
for whom surplus{c, d) is minimum, and delete surplus{c, d) voters from V who vote Yes for c and 
No for d (such voters must exist, as they are what is causing the surplus in the first place). □ 

4.2.3 Adding Candidates, Destructive Case, Condorcet and Approval Voting 

Next, we prove that both Condorcet and approval voting are certifiably- vulnerable (and thus vul- 
nerable) to destructive control by adding candidates. 

Theorem 4.25 Both Condorcet and approval voting are vulnerable/ certifiahly-vulnerable to destruc- 
tive control by adding candidates. 

Proof. That susceptibility holds in this case is shown by Theorem 14. 41 

We again prove only certifiable vulnerability, since this here implies vulnerability. We are given 
a set C of qualified candidates and a distinguished candidate c G C, a set D of possible spoiler 
candidates, and a set V of voters with preferences (in the approval case, the "preferences" are 0-1 
vectors) over C U D. 

For Condorcet voting, if c already is not the Condorcet winner, adding no candidates accomplishes 
our goal, and we are done. Otherwise, if any spoiler candidate ties or beats c, add one such candidate 
and halt. Otherwise, output "control impossible" and halt. 

For approval voting, if c already is not the unique approval winner in the election (C, V), adding 
no candidates accomplishes our goal, and we are done. Otherwise, if there exists a spoiler candidate 
d who ties or beats c among the voters in V in Yes votes, add one such spoiler candidate and halt. 
Otherwise, output "control impossible" and halt. □ 



4.2.4 Deleting Candidates, Partition and Run-off Partition of Candidates, Construc- 
tive Case, Approval Voting 

Finally, we show the vulnerability results for approval voting for constructive control by deleting 
candidates, and by partition of candidates and run-off partition of candidates, both in model TE. 

Theorem 4.26 Approval voting is vulnerable/ certifiably-vulnerable to constructive control by delet- 
ing candidates, partition of candidates in model TE, and run- off partition of candidates in model TE. 

Proof. That susceptibility holds in this case is shown by Theorem 14.41 and Example 14. 141 

As in the previous proofs, we only show certifiable vulnerability, which again implies vulnerability. 
Thus, no "fc" is specified in the control problem corresponding to the deleting candidates case, and 
in all three cases we are given a set C of candidates, a distinguished candidate c, and a set V of 
registered voters. We now describe a polynomial-time algorithm for each of the three constructive 
control problems considered. 
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In the deleting candidates case, if c already is the unique approval winner in the election (C, V), 
deleting no candidates accomplishes our goal, and we are done. Otherwise, delete every candidate 
other than c who has at least as many Yes votes as c has in V and halt. 

In the partition of candidates case, if c already is the unique approval winner, then output (0, C) 
as a successful partition and halt. Otherwise, for each candidate a G C, let i/a denote the number 
of Yes votes cast for ainV, and let Y = maxjj/a | a G C}. 

Now, if there exists exactly one a G C — {c} such that ya = Y , then output "control impossible" 
and halt, since c cannot be made the unique winner in this case. On the other hand, if there exist 
at least two distinct candidates in C — {c} whose number of Yes votes is Y, then output (Ci, C2) 
with Ci — C — {c} and C2 = {c} as a successful partition and halt. This works, since in subelection 
(Ci , V) all candidates are eliminated. 

Note that the same algorithm also works for the run-off partition of candidates case in 
model TE. □ 



4.3 Proving Resistance 

The resistance results arc based on clear containments in NP, plus (polynomial-time many-one) 
reductions establishing NP-hardness. 

The following lemma says that for the voting systems considered here (though that may be 
different in general), whenever the corresponding control problem is NP-hard, immunity cannot 
hold unless P = NP. 

Lemma 4.27 For each voting system for which winnership can he tested in polynomial time, if the 
control problem corresponding to one of the settings considered here is NP-hard, then the system 
cannot be immune to control in this setting unless P — NP. 

Proof. Consider any voting system for which winner-testing ("Is c a winner?") can be done in 
polynomial time. Suppose that the decision problem associated with any one of the control scenarios 
defined in Section |3| is NP-hard. Then, as mentioned in Footnote 0] if immunity were to hold, the 
associated decision problem would be in P, which would imply P = NP. □ 

However, proving immunity and susceptibility under assumptions regarding P-versus-NP is ob- 
viously less attractive than proving immunity and susceptibility unconditionally. In particular, the 
ideal first step toward proving resistance results is to prove, via theorems or examples, susceptibility 
to the corresponding types of control. We have done that in Section im and will invoke items from 
that section here. 

4.3.1 Plurality Voting 

We whenever possible try to achieve multiple resistance results via a single proof. For example, 
with a single proof we establish the key part of all seven resistance results for plurality voting: 
destructive control by adding, deleting, partition (TE and TP), and run-off partition (TE and TP) 
of candidates, "'^^ and by partition of voters (TP). We now provide this proof, which is achieved via 
one general construction that yields the reductions, each from the NP-complete problem Hitting Set, 
see Garey and Johnson |G,T79j . 

'^'^Our constructions ensure that the distinguished candidate is never tied for winner in any subelection in the image 
of the NP-hardness reduction. Thus, these results hold both in the Ties-Eliminate and Ties-Promote models. 
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Hitting Set 

Given: A set B = {61, 62, . . . , bm}, a family <S = {81,82, ■ ■ ■ , 8n} of subsets 5, of B, and a positive 
integer k. 

Question: Does S have a hitting set of size at most k? That is, is there a set B' C B with ||-B'|| < k 
such that for each i, 5^ n B' ^ 0? 

We now present our general construction for the destructive control problems related to plurality 

voting. 

Construction 4.28 (Construction of an Election from a Hitting Set Instance) Given a 

triple {B, S, k), where B = {hi, 62, • • • , &m} is a set, S = {8\, 82, ■ ■ ■ , 8n} is a family of subsets 8i 
of B, and k <m is a positive integer, we construct the following election: 

• The candidate set is C = B U {c, w}. 

• The voter set V is defined as follows: 

— There are 2(m — k) + 2n{k + 1) + 4 voters of the form c> w > ■ ■ ■ , where "■ ■ ■ " means 
that the remaining candidates follow in some arbitrary order. 

— There are 2n{k + 1) + 5 voters of the form, w > c > ■ ■ ■ . 

— For each i, 1 < i < n, there are 2(k + 1) voters of the form Si > c > ■ ■ ■ , where "Si " 
denotes the elements of 8i in some arbitrary order. 

— Finally, for each j, 1 < j <m, there are two voters of the form bj > w > ■ ■ ■ . 

We now show that the election (C, V) constructed above has some useful properties needed to 
establish resistance to destructive control for plurality voting in the seven settings mentioned. For 
every candidate d, let score{d) denote the number of voters who rank d first in a given election. 

Claim 4.29 If B' is a hitting set ofS of size k, then w is the unique plurality winner of the election 
{B'U{c,w},V). 

Proof. If B' is a hitting set of <S of size k, then in the election {B' U {c, w},V), we have 

score{c) = 2(m - fc) + 2n{k + 1) + 4, 

score{w) = 2n(fc + 1) + 5 + 2(to — fc), and 
score(bj) < 2n(k + 1) + 2 for each j. 

It follows that w is the unique plurality winner of the election [B' U {c, w},V). □ 

Claim 4.30 Let D C BU {w}. If c is not the unique plurality winner of election {D U {c}, V), then 

there exists a set B' Q B such that 

1. D = B'U {w}, 

2. w is the unique plurality winner of the election {B' U {c, w}, V), and 

3. B' is a hitting set of S of size less than or equal to k. 
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Proof. Let D C_ B U {w} and suppose that c is not the unique plurahty winner of election 
{D U {c}, V). We show the three properties stated in the claim. 

First note that for all 6 G I? H i?, score{b) < score{c) in (D U {c}, V). Since c is not the unique 
plurality winner of {D\j{c},V), it follows that w £ D and score{w) > score{c). Let B' C B he 
such that D = B' U {w}. Then D U {c} = B' U {c, w}. Since score{w) is odd and score{c) is even, it 
follows that w is the unique plurality winner of {B' U {c, w}, V). This proves the first two properties 
stated. 

To prove the third property, note that in (B' U {c, w}, V), we have 



where ^ is the number of sets in S that are not hit by B' (i.e., that have an empty intersection 
with B'). Since score{c) < score{'w), it follows that 



2(m -k) + 2{k + !)£<! + 2(to - 
which implies (fc + 1)£ + \ \B'\ \ — fc < 0. So £ = 0. Thus, B' is a hitting set of S of size at most fc. 



Next, we show that Construction 14 . 2S1 vields a polynomial-time many-one reduction from Hitting 
Set to Destructive Control by Adding Candidates for plurality voting. 

Claim 4.31 S has a hitting set of size less than or equal to k if and only if destructive control by 
adding candidates can be executed for the election with qualified candidates {c,w}, spoiler candi- 
dates B, distinguished candidate c, and voter set V . 

Proof. If S has a hitting set of size less than or equal to fc, then since k < m, S has a hitting 
set of size fc. Thus, the implication from left to right follows from Claim 1?!^ The implication from 
right to left follows from Claim 11301 □ 

So from this and Theorem 14 . 41 we have the following. 

Corollary 4.32 Plurality voting is resistant to destructive control by adding candidates. 

By a similar argument. Hitting Set can be reduced to Destructive Control by Deleting Candidates 
for plurality voting. 

Claim 4.33 S has a hitting set of size at most k if and only if the election with candidate set C , 
distinguished candidate c, and voter set V can be destructively controlled by deleting at most m — k 
candidates. 

Proof. Let B' be a hitting set of S of size fc. By Claim c is not the unique plurality winner 
of the election (B' U {c, w}, F). Since B' U {c,w} = C - (B - B'), \\B\\ = m, and \\B'\\ = fc, the 
right-hand side of the equivalence follows. 

For the converse, let D C B U {w} be such that \\D\\ < m — k, and suppose that c is not 
the unique plurality winner of {C — D,V). Since c € C — D, it follows from Claim that 
(C — D) — {c} — B' U {w}, where B' is a hitting set of S of size less than or equal to fc. □ 

So from this and Example 14 . 1 51 we have the following. 



score{w) 
score{c) 



2n(fc + l) + 5 + 2(m-||B'||) and 
2(m -k) + 2n{k + 1) + 4 + 2(fc + !)£, 



which proves the third property. 



□ 
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Corollary 4.34 Plurality voting is resistant to destructive control by deleting candidates. 

Now, we show that Construction 14.281 also yields a polynomial-time many-one reduction from 
Hitting Set to Destructive Control by Partition of Candidates for plurality voting. 

Claim 4.35 S has a hitting set of size at most k if and only if the election with candidate set C , 
distinguished candidate c, and voter set V can be destructively controlled by partition of candidates 
(both in model TE and TP). 

Proof. Let B' be a hitting set of S of size k. Partition C into Ci = B' U {c, w} and C2 = B — B'. 
By Claim B.29I w is the unique plurality winner of (Ci,y), and c thus cannot win the election 

iCV). 

For the converse, suppose that there exists a partition of candidates such that c is not the 
unique plurality winner of the two-stage election corresponding to that partition. Then, certainly 
there exists a set D C B \J {w} such that c is not the unique plurality winner of {D U {c}, V). By 
Claim ^201 S has a hitting set of size at most k. □ 

So from this and Example 14. 1 51 we have the following. 

Corollary 4.36 Plurality voting is resistant to destructive control by partition of candidates (both 
in model TE and TP). 

The same argument works for proving that plurality voting is resistant to destructive control by 
run-off partition of candidates, again by a reduction from Hitting Set. 

Claim 4.37 S has a hitting set of size at most k if and only if the election with candidate set C , 
distinguished candidate c, and voter set V can be destructively controlled by run-off partition of 
candidates (both in model TE and TP). 

Proof. Let B' be a hitting set of S of size k. Partition C into Ci = B' U {c, w} and C2 = B — B'. 
By Claim B.29I w is the unique plurality winner of {Ci,V), and c thus cannot win the election 
iC,V). 

For the converse, suppose that there exists a partition of candidates such that c is not the unique 
plurality winner in the run-off election corresponding to that partition. Then, certainly, there exists 
a set D C BU {w} such that c is not the unique plurality winner of {D U {c}, V). By Claim ^301 S 
has a hitting set of size at most k. □ 

So from this and Examole 14. 1 51 we have the following. 

Corollary 4.38 Plurality voting is resistant to destructive control by run- off partition of candidates 
(both in model TE and TP). 

Finally, we show that plurality voting is resistant to both constructive and destructive control by 
partition of voters in the TP model. To this end, we reduce from the Hitting Set problem restricted 
to instances where n{k -f 1) + 1 < m — k. We first define this restriction and prove that it still is 
NP-complete. 
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Restricted Hitting Set 

Given: A set i? = {bi, 62, ... , b„i}, a family S = {Si, S2, ■ ■ ■ , Sn} of subsets Si of B, and a positive 
integer k sucli tliat n{k + 1) + 1 < m — k. 

Question: Docs S liave a hitting set of size at most fc? Tliat is, is there a set B' C B with | | < k 
such that for each i, Si (IB' ^97 

Theorem 4.39 Restricted Hitting Set is NP-complete. 

Proof. Restricted Hitting Set clearly is in NP. To show that it is NP-hard, we reduce Hitting Set 
to Restricted Hitting Set. Let {B,S,k) be a Hitting Set instance, where 

B = {^1,62, . . . ,6a}, 

S = {Si, 52, ... , Sn}, 

Si ^ B for each i, 1 < i < n, and fc + 1 < to. Define an instance of Restricted Hitting Set [B, S, k), 
where 

B = B(J {a,j I 1 <i <n and 1 < j < fc + 1}, 

St = S'i U {fli^, aj,2, . . . , ai,fe+i}, for 1 < z < n, and 

S = {Si, S2, ■ ■ ■ , Sn}. 

It is immediate that S has a hitting set of size k if and only if S has a hitting set of size k. 
Let TO — \\B\\ = TO + n{k + 1). Since fc + 1 < to, we have 

n{k + 1) + k + 1 < n{k + 1) + in = m, 

i.e., n(fc + 1) + 1 < to - A:. □ 



Claim 4.40 In the election {C, V) from Construction if n(k + 1) + 1<to — fc then for every 

partition of V into Vi and V2, c is a plurality winner of (C, Vi) or of (C, V2). 

Proof. For a contradiction, suppose that c is a winner of neither (C, Vi ) nor (C, V2 ) . For each 
U CV and for each i € C, let scoreu{i) denote the number of first-place votes that i has in (C, U). 
Let a; G B U {w} be a winner of (C, Vi), and let y e _B U {w} be a winner of (C, ¥2). Then 

(4.8) scorev^ix) + scorev2{y) > scorev{c) + 2. 

Since c's score in (C, V) is greater than that of any other candidate, we have x ^ y. It follows that 

scorevi{x) + scorev2{y) < scorev'(w) + scorevih) 

< 2n(fc + l) + 5 + 2n(fc + l) + 2 

< 2n(fc+l) + 5 + 2(TO-fc) 
= scorev{c) + 1, 

which contradicts Equation 14. 8|) . Thus, c is a winner of (C, Vi) or of (C, V2). Q 

We now show that Construction 14. 2S1 also provides a reduction from Restricted Hitting Set both 
to Constructive Control by Partition of Voters and to Destructive Control by Partition of Voters in 
the Ties-Promote model for plurality voting. 
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Claim 4.41 In the election [C^V) from Construction \4 ■ ifn{k+l) + l < m — k then the following 
three statements are equivalent: 

1. S has a hitting set of size at most k. 

2. V can he partitioned such that w is the unique plurality winner in the TP model. 

3. V can he partitioned such that c is not the unique plurality winner in the TP model. 

Proof. To show that the first statement impUes the second statement, let B' be a hitting set of 
S of size k. Partition V into Vi and V2, where Vi consists of one voter of the form w > c > ■ ■ ■ 
and for every h £ B' one voter of the form 6 > w > ■ • ■ , and where V2 = V — Vi. Then the 
candidates in B' U {w} are the winners of (C, Vi) and move forward to the run-off in tlie TP model, 
and c is the winner of (C, ¥2). By Claim l¥.29l w is the unique plurality winner of the final election 
{B'\J{cM.V). 

Clearly, if w is the unique plurality winner for some partition of V in the TP model, then c cannot 
be the unique plurality winner of this election for the same partition. Thus, the second statement 
implies the third statement. 

Finally, we show that the third statement implies the first statement. Suppose there is a partition 
of V such that c is not the unique plurality winner of the election in the TP model. By Claim ^301 
c is a winner of one of the subelections and will thus participate in the final run-off. It follows 
that c is not the unique winner of a run-off election involving c, i.e., c is not the unique winner in 
{D U {c}, y), for some C _B U {w}. By Claim E^UI S has a hitting set of size at most k. This 
completes the proof. □ 

Theorem 14. 391 Claim 1^^^ and Example 14 . 1 61 have the following corollary. 

Corollary 4.42 1. Plurality voting is resistant to constructive control by partition of voters in 
model TP. 

2. Plurality voting is resistant to destructive control by partition of voters in model TP. 
4.3.2 Approval Voting, Constructive Case, Voter Control 

For approval voting, our reductions proving resistance are from the NP-complete problem Exact 
Cover by Three-Sets (X3C, for short), see Carey and Johnson |CJ79| . 

Exact Cover by Three-Sets (X3C) 

Given: A set B = {bi,b2, . . . ,bm}, where m = 3k for a positive integer k, and a family S = 
{81,82, ■ . ■ , 8n} of subsets 8i of B with ||S'i|| = 3 for each i. 

Question: Does S have an exact cover for Bl That is, is there a subfamily iS' C 5 such that every 
element of B occurs in exactly one set in S'7 

Theorem 4.43 Approval voting is resistant to constructive control by adding voters. 

Proof. That susceptibility holds in this case is shown by Example 14. Ill 

Given an instance {B,S) of X3C, where B — {61, 62, • ■ • , fem}, fn — 3fc, k > 1, S ~ 
{81, 82, ■ . . , 8n}, and 8i ^ B with — 3 for each i, 1 < i < ri, construct the following in- 

stance of Constructive Control by Adding Voters for approval voting: 
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• The candidate set is C = B U {w}, where w is the distinguished candidate. 

• V consists oi k — 2 registered voters who each approve of 61, 62, • • ■ , and disapprove of w. 

• W consists of n unregistered voters: For each i, I < i < n, there is one voter in W who 
approves of w and the three candidates in Si, and who disapproves of aU other candidates. 

We claim that S contains an exact cover for B if and only if w can be made the unique approval 
winner by adding at most k voters. 

For the left to right direction, simply add the k voters from W that correspond to the exact 
cover for B. Then w has k Yes votes and every b E B has (fc — 2) + l = fc — 1 Yes votes, so w is the 
unique approval winner. 

For the right to left direction, suppose that w can be made the unique approval winner by adding 
at most k voters. Then we clearly need to add exactly k voters and every b Q B can gain at most 
one Yes vote. Since each voter in W casts three Yes votes for candidates in B, it follows that every 
b E B gains exactly one Yes vote. Thus, the k added voters correspond to an exact cover for B. □ 

Theorem 4.44 Approval voting is resistant to constructive control by deleting voters. 

Proof. That susceptibility holds in this case is shown by Example 14. 131 

Let an instance {B,S) of X3C be given, where B — {&i, 62, . . . , fem}, = 3fc, k > 0, S = 
{Si, S2, ■ ■ ■ , Sn}, and Si Q B with ||5'i|| = 3 for each i, \ < i < n. For each j, 1 < j < m, let 

£, = meS \ b,eS,}\\. 

Construct the following election: 

• The candidate set is C = B L) {w}, where w is the distinguished candidate. 

• The voter set V consists of the following voters: 

— For each i, 1 < i < n, there is one voter in V who approves of all candidates in Si and 
who disapproves of all other candidates. 

— There are n voters vi, V2, . . . , w„ in V such that, for each i, 1 < i < n, Vi approves of w, 
and Vi approves of bj if and only if i < n ~ £j. 

Note that the election (C, V) has the property that all candidates have n Yes votes. 

We claim that S contains an exact cover for B if and only if w can be made the unique approval 
winner by deleting at most k voters. 

For the left to right direction, simply delete the k voters from V that correspond to an exact 
cover for B. Then every b E B loses one Yes vote, leaving w the unique approval winner. 

For the right to left direction, suppose that w can be made the unique approval winner by 
deleting at most k voters. Without loss of generality, we may assume that none of the deleted voters 
approves of w. So, we assume that only voters corresponding to S'i's have been deleted. For w to 
have become the unique winner, every b E B must have lost at least one Yes vote. It follows that 
the deleted voters correspond to a cover, and since the cover has size at most k, this must be an 
exact cover for B. □ 

Theorem 4.45 Approval voting is resistant to constructive control by partition of voters in 
model TP. 
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Proof. That susceptibility holds in this case is shown by Example 14. 171 

Let an instance {B,S) of X3C be given, where B — {&i, 62, . . . , 6m}, rn = 3k, k > 0, S = 
{Si, 5*2, ... , Sn}, and Si C B with ||S'i|| =3 for each i, 1 < i < n. We modify the construction from 
the proof of Theorem 14. 441 As in that proof, for each j, I < j < m, let 

£, = \ 6, G5JII. 

Now, define the following election: 

• The candidate set is C = -B U {w, x, y}, where w is the distinguished candidate. 

• The voter set V consists of the following voters: 

— For each i, 1 < i < n, there is one voter in V who approves of y and of all elements of Si 
and who disapproves of all other candidates. 

— There are n voters ui, i;2, . . . , in 1^ such that, for each i, 1 < i < n, Vi approves of w, 
Vi disapproves of a;, Vi disapproves of y, and Vi approves of bj if and only if i < n — £j. 

— There are fc + 1 voters in V who approve of x and disapprove of all other candidates. 

— Finally, there are fc+2 voters in V who disapprove of x and approve of all other candidates. 

Note that this election has the property that all candidates other than x have n + k + 2 Yes votes. 

We claim that S contains an exact cover for B if and only if w can be made the unique approval 
winner by partition of voters in model TP. 

For the left to right direction, if S contains an exact cover for B, then let V2 consist of the k 
voters corresponding to the sets in the cover and of all the A; + 1 voters who approve of only x, and 
let Vi^V -V2. Then 

• w is the unique approval winner of (C, Vi ) , 

• a; is the unique approval winner of (C, V2), and 

• w wins the run-off against x. 

For the right to left direction, suppose that w can be made the unique approval winner by 
partition of voters in model TP. Since w is the unique winner in the run-off, and since every 
candidate other than x is tied with w (each having n + k + 2 Yes votes in V), the only candidates 
that can participate in the run-off are w and x. Since we are in the TP model, w must be the unique 
winner of one of the subelections and x must be the unique winner of the other subelection. 

Let (Vi, V2) be a partition of V such that w is the unique winner of (C, Vi) and such that x is the 
unique winner of (C, V2). As in the proof of Theorem 14.441 it follows that the voters corresponding 
to S'i's that are not in Vi (i.e., that are in V2) correspond to a cover. Since x is the unique winner of 
(C, V2) and X has k+1 Yes votes, y can have at most k Yes votes in V2. It follows that there are at 
most k voters corresponding to Si's in ¥2- Thus, there are exactly k such voters, and these voters 
correspond to an exact cover. □ 

Note that the previous construction won't work for the TE model, since in that model, w also 
wins the election if two or more candidates are tied for first place in ¥2- In the proof of the next 
theorem, we will adapt the construction from the proof of Theorem 14.451 

Theorem 4.46 Approval voting is resistant to constructive control by partition of voters in 
model TE. 
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Proof. That susceptibility holds in this case is shown by Example 14. 171 

Let an instance {B,S) of X3C be given, where B — {&i, 62, . . . , 6m}, rn = 3k, k > 0, S = 
{Si, 5*2, ... , Sn}, and Si C B with ||S'i|| =3 for each i, 1 < i < n. We modify the construction from 
the proof of Theorem l4.45l As in that proof, for each j, I < j < m, let 

£, = meS \ b,eS,}\\. 

Now, define the following election: 

• The candidate set is C ^ B U {w, x, y} U {zi, . . . , z„}, where w is the distinguished candidate. 

• The voter set V consists of the following voters: 

— For each i, 1 < i < n, there is one voter in V who approves of y and of all elements of Si 
and who disapproves of all other candidates. 

— For each i, 1 < i < n, there is one voter in V who approves of y and Zi and who disapproves 
of all other candidates. 

— There are n voters vi,V2, ■ ■ ■ ,Vn i'tl V such that, for each i, 1 < i < n, Vi approves of w, 
Vi disapproves of a;, Vi disapproves of y, Vi approves of bj if and only if i < n — £j, and Vi 
approves of Zj if and only if i =/= n. 

— There are n-\-k voters in V who approve of x and who disapprove of all other candidates. 

Note that this election has the property that all candidates other than x and y have n Yes votes. 

We claim that S contains an exact cover for B if and only if w can be made the unique approval 
winner by partition of voters in model TE. 

For the left to right direction, if S contains an exact cover for B, then let V2 consist of the k 
voters corresponding to the sets in the cover and of all the n + k voters who approve of only x and 
for each i, 1 < i < n, of the voter who approves of only y and z^. Let Vi = V — ¥2- Then w is the 
unique approval winner of (C, ^i), and x and y are tied for first place in (C, V2) with n + k Yes votes 
each. Since we are in model TE, no candidates are nominated by (C, V2), and w wins the run-off' 
(and thus the election) by default. 

For the right to left direction, suppose that w can be made the unique approval winner by 
partition of voters in model TE. Since we are in model TE, w must be the unique winner of one of 
the subelections. Let {Vi, V2) be a partition of V such that w is the unique winner of (C, l^i). As in 
the proof of Theorem 14.441 it follows that the voters corresponding to S'^'s that are not in Vi (i.e., 
that are in V2) correspond to a cover. 

Suppose that there are more than k voters that correspond to Si's in V2. Note that for each i, 
I < i < n, the voter that approves of only y and Zi must also be in V2 (for if it weren't, Zj would 
have at least as many Yes votes in Vi as w). It follows that y has more than n + k Yes votes in 
V2 . But then y is the unique approval winner in V2 , since no other candidate has more than n + k 
Yes votes in V. Since y beats w in the run-off, this contradicts the fact that w wins the election. It 
follows that there are at most k voters corresponding to Si's in ¥2- Thus, there are exactly k such 
voters, and these voters correspond to an exact cover. □ 



5 Conclusions 

In this paper, we studied the computational resistance and vulnerability of three voting systems — 
plurality, Condorcet, and approval voting — to destructive control by an election's chair in each of 
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seven control scenarios: candidate addition, suppression, partition, and run-off partition, and voter 
addition, suppression, and partition. We classified each case as immune, vulnerable, or computa- 
tionally resistant. We also studied the analogous constructive control cases and fully resolved those 
that were not considered by Bartholdi, Tovey, and Trick |BTT92| . 

We identified cases where a system immune to constructive control still can be vulnerable to 
destructive control (e.g., Condorcet voting for control by adding candidates), and vice versa (e.g., 
approval voting for control by deleting candidates). We saw that, among the systems studied, none 
is globally superior to the others. Rather, when choosing a voting system, one's choice will depend 
on the types of control against which protection is most desired. Finally, we saw that — in contrast 
to some comments in earlier papers — tie-breaking is a far from minor issue: For those control types 
that involve partitions of the candidate or voter set, we studied two natural tie- handling rules, and 
we found specific cases in which the complexity of the corresponding control problem varies crucially 
depending on which tie-handling rule is adopted. 

Acknowledgments: We thank Jeroen Snippe for helpful comments, and we thank Klaus Wagner 
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